Toward Identifying Cyber Dependencies in Water Distribution Systems Using Causal AI

Abstract

Water distribution systems are complex critical infrastructures that are vulnerable to cyberattacks, yet there is a lack of research on understanding the dependencies and interdependencies in these systems. Assessing dependencies is critical for isolating affected components during a cyber-related event. In this work, we explore causal artificial intelligence (AI) to model dependencies of a water distribution network and how it aids in monitoring cyberattacks and anomalies in the network. To achieve this, we used generative adversarial network (GAN) models for simulating data poisoning attacks on two components, a valve and a tank, of the C-Town network, an EPANET-simulated data set. The results indicate this approach provides an understanding of the dependencies in a system when combined with existing domain knowledge. The impact to dependencies varies for the two attacks. The attack on the valve, a critical component in the network, affected six dependencies total, causing five to drop below 1×10−7 (our threshold to filter low dependency as no measurable effect), and the remaining have a 1- to 1.3-fold difference depending on the GAN model used. The tank, however, has a more subtle change in dependency that is harder to notice because it can only impact two dependencies, which only saw a 46%–76% change. These insights would allow plant operators to analyze changes in system dependencies when the data are poisoned and demonstrate the feasibility of causal AI for dependency quantification and anomaly detection.